44953d62600a0e07c031b37cbb095654_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44953d62600a0e07c031b37cbb095654_JaffaCakes118
Size

16KB
MD5

44953d62600a0e07c031b37cbb095654
SHA1

c39ce5f3e4927ff1ae22d72678d84d5315eb6142
SHA256

56e711bdcc5dec44a5a4d3c0f90ec3dda011b9f60f23d3c7fc378e60ab6bb3b1
SHA512

c6115bfff14331c975b64bf24a3aab968bcd6fa4a2c880d2995ce549e9df230abb5bd83a37d1a019fce8adc885235b8d8471a54f3eec279eb5998781eb2d1167
SSDEEP

384:mJW4soCq+8pV/mT1vmR/CjxrrlvaKtLjHzj4tYc76H:hM+4VC1v+/CjxrFBzj4yc76H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44953d62600a0e07c031b37cbb095654_JaffaCakes118

Files

44953d62600a0e07c031b37cbb095654_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5e34ed2555b9aab8f778c6b51fdac193

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
GetLongPathNameA
GetTempPathA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
Sleep
CreateThread
CloseHandle
lstrcmpiA
GetLastError
GetCurrentProcess
IsBadReadPtr
GetModuleHandleA
WinExec
_lclose
_lwrite
_lcreat
GetSystemDirectoryA
DeleteFileA
GetTempFileNameA
TerminateProcess
OpenProcess
GetFileAttributesA
FreeLibrary
ReleaseMutex
CreateMutexA

shlwapi

StrStrIA
PathStripPathA
PathRemoveFileSpecA

msvcrt

strrchr
_stricmp
_except_handler3
_itoa

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 966B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ